From AI to analog, cybersecurity tabletop exercises look a little different this year

It's the most wonderful time of the year … for corporate security bosses to run tabletop exercises, simulating a hypothetical cyberattack or other emergency, running through incident processes, and practicing responses to ensure preparedness if when a digital disaster occurs. "We're ultimately testing how resilient is the organization," said Palo Alto Networks Chief Security Intelligence Officer Wendi Whitmore in an interview with The Register. "It's not if we get attacked, it's: How quickly do we respond and contain these attacks." And this year, organizations need to account for the speed of AI, both in terms of how attackers use these tools to find and exploit bugs, and how defenders can use AI in their response. "Threat actors are exploiting CVEs at an increased rate with AI," Google Cloud's Office of the CISO Public Sector Advisor Enrique Alvarez told The Register. "Tabletop exercises should consider a scenario where a CVE is published affecting a software system in use by the company with an immediate exploit via a cyber adversary." Whitmore said her threat analysts see a vulnerability released with exploits attempted within five minutes. "On the defender side, like our own SOC: We're looking at 90 billion attack events coming in per day, which we can synthesize down into 26,000 that are correlated, and then one per day that requires human manual intervention of tier-three analysts to dive in, and run additional queries and analysis," she added. Indeed, if 2025 taught u...